Transfer an ISO 27001 Certificate

An ISO 27001 transfer recognizes a current accredited information-security certificate and issues a new one for the same scope. The statement of applicability, the risk assessment, and the controls already in operation stay with the company. The transfer does not ask you to rebuild the ISMS so a new body can put its mark on it.

Which edition can transfer?

The certificate has to be ISO/IEC 27001:2022. Certificates to the 2013 edition are no longer current. A file that still cites 2013 is an initial certification to the 2022 edition. Choose initial certification on the application and expect an audit against the 2022 controls.

SMG's accreditation includes ISO/IEC 27001:2022. The review checks that the activities in the statement of applicability sit inside that accreditation. The record is on the SMG page.

What does the review read besides the certificate?

It reads the latest certification or recertification report, the latest surveillance report, and the status of nonconformities. It needs the scope: locations, functions, and the services inside the ISMS. A certificate that says "the whole company" and a report that sampled one product team is a mismatch the review will surface.

Exclusions need the justification already accepted at the last audit. Changing exclusions during a transfer is a scope change, and scope changes are audited. See changing scope during a transfer.

Why do companies move this certificate?

Buyers ask for it in security questionnaires. They check that it is current and accredited. Slow letters from the current body, or a surveillance date that collides with a customer audit, are common reasons to move while the certificate is still valid. Those reasons are in why companies change body.

On the application, select ISO/IEC 27001 and Transfer from another body. Describe the scope as the certificate states it. IAF Consultancy replies with a written offer: scope, timing, and price. IAF Consultancy audits. SMG issues the certificate under IAS accreditation MSCB-153. The surrounding steps are in how a transfer works.